<POSTTORY LIBSARY MATER 147, 


Internal 
Audit 


Asa eal 


CASRN 
Prise | 


- 


The Management Cycle 


- Government 
_ Manager 


Wahigarsl, 
Audit 


Contents 


Preface 
1. Introduction 
2. The Internal Audit Function 


3. Principles and Standards for Ministry 
Internal Audit Processes 


Appendix A 
Requirements for EDP Auditing 


Appendix B 
Description of a Typical Ministry Audit 
Committee 


Appendix C 

Summary Extract from “Standards for the 
Professional Practice of Internal Auditing in 
the Government of Ontario” 


Appendix D 
Summary of the Principles and Standards for 
Ministry Internal Audit Processes 


, 
Coverniier 


Publications 


Page 


13 


ak, 


20 


22 


Preface 


The Management Standards Project was 
approved by the Management Board and 
Cabinet in March, 1980. Its purpose is to lay 
the groundwork for further improving man- 
agement in the Ontario Public Service over 
the next decade by: 


® establishing a basic framework for manag- 
ing in the ‘80's; 


@ developing a publications series which 
includes standards for the quality of 
management in the ‘80's; and 


@ ensuring that forums for dialogue on 
management issues and initiatives are 
established. 


Ontario’s Management Philosophy was 
published in early 1981 as a cornerstone to 
this series of booklets on principles and 
standards for management processes. The 
Philosophy states that: 


“.,, the management process channels, in a 
purposeful manner, the vitality of each 
individual. It brings people together in goal- 
oriented teams and creates an efficient 
network of communication.” 


This booklet is one of the first published 
which describes a ministry management 
process and sets standards for that process. 
The framework within which the “Ministry 
Management Processes’ series is orga- 
nized is the Management Cycle. This book- 
let falls into the “Monitor and Maintain 
Direction” group. 


This booklet was developed through the 
involvement of many ministry staff and 
executives, for use by ministries as a set of 
criteria against which the quality of their 
audit process can be measured. The Man- 
agement Standards Project gratefully 
acknowledges the contribution of all those 
involved. 


The standards in this booklet must be open 
to revision as times and needs change. It is 
recognized that no ministry will measure up 
to all the principles and standards immedi- 
ately, but that every ministry meets some of 
the standards and has a process base on 
which to build. 


The Management Standards Project, will 
work closely with the Civil Service Commis- 
sion and ministries, in encouraging the 
development of comprehensive training and 
education programs to complement these 
process publications, and will continue to 
establish forums for dialogue. 


Whatever method of accountability for meet- 
ing standards is applied, ministry managers 
should use these as one basic self-measure 
of the quality of their management. The 
driving force in the attainment of manage- 
ment standards will continue to be a self- 
imposed striving for excellence. 


September 30, 1981. 


1. Introduction 


Purpose 

This booklet is to provide senior manage- 
ment with the key principles and manage- 
ment standards essential for a successful 
internal audit process. Senior management 
will then be able to evaluate whether these 
principles and standards are being metin 
their ministry. 


In this context, senior management com- 
prises those officials who are in the position 
of evaluating audit processes. The Deputy 
Minister is invariably one of those officials, 
but other senior ministry staff, for example 
members of an Audit Committee, may also 
be in this position. 


This booklet sets principles and standards 
for the core functions of Internal Audit in 
ministries based on the new role, but is not 
intended to necessarily encompass related 
functions such as operational review. 


Structure 
The booklet contains two parts and several 
appendices. 


Chapter 2 provides a basic understanding 
of recent trends in internal auditing and of the 
objectives, role and potential benefits of the 
Internal Audit Process. 


Chapter 3 deals with the key principles and 
standards to be used by senior management 
in evaluating their own Internal Audit Pro- 
cess. 


Terminology 

Throughout this booklet a number of terms 
are used which have a specific meaning 
within the context of the Internal Audit 
Process. The commonly agreed definitions 
are: 


Control 


Maintaining the direction established for a 
ministry by its management. Emphasis is on 
monitoring results to ensure that they meet 
management's expectations and assist 
management in maintaining accountability. 


Financial Control 


The activities concerned with: 


(i) safe-guarding funds and other public 
property; 

(ii) ensuring compliance with legislative, 
central agency and ministry authorities; 
and 

(iii) providing financial information for 
ministry management decision making 
and for higher levels of authority. 


Management Control 


The activities concerned with ensuring that 
there is due regard to economy and effi- 
ciency and that appropriate procedures to 
evaluate and report program effectiveness, 
where such are feasible, are in place and 
operating satisfactorily. 


Economy 


The terms and conditions under which the 
Government acquires human and material 
resources. An economical operation 
acquires these resources in appropriate 
quality and quantity at the lowest cost. 


Efficiency 


The relationship between goods or services 
produced and resources used to produce 
them. An efficient operation produces the 
optimum output for a given level of 
resources. Efficiency is obviously more 
measurable and/or controllable in some 
situations than in others. 


Effectiveness 


The extent to which a program achieves its 
goals or intended effects. Management 
procedures for measuring and reporting 
effectiveness will differ between programs, 
and not all programs are equally evaluable in 
terms of effectiveness. 


2. |The Internal Audit Function 


Current Trends in Internal 
Audit 


In order to add perspective to the material 
contained in this part, it is necessary to 
summarize briefly recent changes in the 
concept of the audit function. 


The concerns of the internal audit function in 
government are expanding. Traditionally, 
internal audit has been concerned in the 
main with the evaluation of financial con- 
trols. Now, in addition to these traditional 
concerns, management control processes 
are increasingly being evaluated by internal 
audit groups. There are several reasons for 
this: 


Value for Money 


There is a growing public concern that the 
government provide maximum public bene- 
fit and value for tax dollars. 


At the legislative level, public interest has 
been reflected in The Audit Act, 1977. The 
Provincial Auditor, by this new Act, is given 
authority to report on any expenditure of 
money made without due regard to economy 
and efficiency or where procedures to 
measure and report on the effectiveness of 
programs are not established or are deemed 
unsatisfactory. 


Accordingly, a growing proportion of the 
Provincial Auditor’s findings is concerned 
with value-for-money issues. These may 
include such basic concerns as whether 
program objectives have been sufficiently 
well-defined and whether financial 
resources are being allocated with due 
regard for overall effectiveness and econ- 
omy. In addition to its concern with the 
accountability of public servants, the Public 
Accounts Committee has indicated very 
strong interest in the attainment of value-for- 
money in the expenditure of public funds. 


The thrust towards attaining better “value- 
for-money” places greater emphasis on 
ministry management processes for ensur- 
ing that managers achieve and can, wher- 
ever possible, measure efficiency, economy 
and effectiveness. In their role as evaluators 
of management control processes on 

behalf of management, internal auditors are 
becoming involved in the value-for-money 
effort. 


Constraint 


For a number of years, Cabinet has had in 
place a policy of restraining the rate of 
growth in government expenditure, in order 
to reduce the burden of government on the 
economy, and to free resources for more 
productive use in the private sector. The 
constraint effort also focuses attention on 
value-for-money since new initiatives are 
generally funded from within limited total 
resources. 


Accountability 


The obligation to answer for responsibilities 
conferred is a matter of growing concern in 
government. The public expects govern- 
ment to be accountable for its management 
of public funds. As the complexity of 
government increases, greater delegation of 
authority occurs, generating the need to 
account for the exercise of delegated author- 


ity. 


Ontario’s Management Philosophy points 
out that decentralization of decision-making 
is basic to the successful operation of the 
Ontario Government and that internal 
accountability requires that every manager 
explain and respond through reporting chan- 
nels. 


Increasingly, the internal auditor is expected 
to audit management reporting systems and 
other processes needed to provide account- 
ability. 


Another significant development in internal 
auditing is the increasing reliance on internal 
audit groups by organizations outside the 
ministry. The Provincial Auditor has recently 
reviewed internal audit groups to determine 
whether he can accept their findings. 


The Management Board Secretariat and the 
Ministry of Treasury and Economics rely 
upon internal audit groups to carry out the 
auditing requirements associated with their 
corporate policies. This has led to the need 
for standards to assure these central agen- 
cies and the Provincial Auditor that auditing 
is being done competently. 


Objectives 

Developing, implementing and maintaining 
control is amanagement responsibility. 
Evaluating the effectiveness of the con- 
trol function on behalf of management is 
the primary function of internal audit. 
Internal Auditing is to assist the Deputy 
Minister and other ministry personnel in the 
effective discharge of their responsibilities 
and can be described under these three 
aspects of internal audit: 


® assurance; 
@ timely reporting; and 
e change. 


Assurance 


that control processes are satisfactory or 
that improvements are necessary: findings 
should be supported by a description of the 
work carried out in arriving at conclusions 
and opinions and should include an assess- 
ment of the risks involved where weak- 
nesses are found. 


Timely Reporting Of Information 


to management concerning potential control 
problems or issues. Examples might include: 
recommendations made and not imple- 
mented; policies or directives which are no 
longer viable; the reliability of information 
supplied through the MBR reporting process 
and new systems and information relating to 
safety or security. 


Change 


in assisting in the correcting of weakness. 
The auditor’s relationships with auditees, the 
way in which his report is expressed and his 
credibility and reputation increase the likeli- 
hood that the audit process will lead to 
constructive change. 


Role 

This booklet as one of the Ministry Manage- 
ment Process series is written within the 
framework of the management cycle. 


‘Internal audit has been described, in part, by 
the Institute of Internal Auditors as “a 
managerial control which functions by meas- 
uring and evaluating the effectiveness of 
other controls”. 


Thus, Internal Audit is clearly within the fifth 
function: “monitor and maintain direction.” 
However, there are preconditions for effec- 
tive internal audit which are found in some of 
the other functions. To put this properly in 
perspective, it is necessary to define more 
precisely and fully what is meant by control 
and the respective responsibilities of man- 
agement and internal audit. 

* 
Effective planning is a precondition for 
control and establishes what is to be done, 
how and when itis to be done, who is to do it, 
and what is to be regarded as satisfactory 
performance. It includes designating objec- 
tives, priorities, resource requirements, 
policies, procedures, organization struc- 
tures, budgets and standards of perform- 
ance. 


In monitoring, actual performance is com- 
pared with that planned. Effective monitoring 
is dependent on the flow of timely, accurate, 
concise and relevant information to manag- 
ers so that matters requiring attention can be 
acted upon in time to minimize any adverse 
effect on the organization. 


Corrective action is taken to solve problems 
indicated by deviations from the plan and to 
make any necessary revisions to plans and 
standards. 


There are three basic aspects to control: 
planning, monitoring and corrective action. 


These three parts of the control function are 
depicted below. 


Figure 1 The Control Function 


Planning 
(Precondition) 


Corrective Action 


The development, implementation, and 
maintenance of the control function are 
management responsibilities. 


There is a periodic need to evaluate the 
effectiveness of the control function for two 
main reasons. The first is to assure manage- 
ment that it has a viable and reliable basis for 
control (or, alternatively, that improvements 
are needed); the second is to report on the 
extent of compliance. 


To sum up, the respective responsibilities of 
ministry management and internal audit in 
respect to the control function are depicted 
on the next page. 


Figure 2 Responsibilities in 
Respect to the Control Function 
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Although the chart above designates devel- 
opment of the control function as a manage- 
ment responsibility, it is desirable for internal 
auditors to review, at the design stage, the 
auditability of systems. This applies particu- 
larly to electronic data processing systems 
because of their complexity, growing impor- 
tance and the cost of any subsequent 
corrective action. (Please see Appendix A 
for requirements in the EDP area.) 


Two potential areas of conflictcanbe _ 
avoided if it is remembered that Internal 
Audit is: 


Distinct From Program Evaluation 


Program evaluation and internal auditing, 
both being assessment functions, are fre- 
quently mistaken for each other. Program 
evaluation considers the effectiveness of a 
program to detemine, in the light of present 
circumstances, its adequacy, relevance and 
the alternatives available. 


Internal auditing focuses on the evaluation of 
financial and management controls within 
any given program. 


A program evaluator basically questions if a 
program is effective in achieving its stated 
objectives. 


An internal auditor, on the other hand, 
accepts the validity of the program and 
reports to managers on whether or not they 
have adequate control over it. 


Distinct From Management 


An auditor’s role is distinct from that of a 
manager. His responsibility is to help manag- 
ers maintain direction so that what they want 
to happen does in fact occur. To do this, an 
auditor concentrates on the control systems 
which keep programs on track. 


Internal auditing is not meant to second- 
guess management noris ita “witch-hunt” to 
find errors. Rather, itis meant to be a positive 
management tool which managers can use 
to help ensure the success of their pro- 
grams. 


To illustrate this point further, it is manage- 
ment’s responsibility to operate programs 
efficiently and economically. Hence, man- 
agement develops, implements and main- 
tains the necessary control systems; e.g. 
systems for measuring productivity or for 
reporting progress against plans. Auditors 
aid managers by evaluating these control 
systems and reporting on whether they work 
satisfactorily. 


Benefits 
Internal Audit is an essential advisory tool of 
ministry management. 


When properly developed and effectively 
employed it provides the following benefits: 
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(i) assurance to ministry management that 
their control processes are satisfactory or 
that weaknesses exist which require correc- 
tive action before the functioning of the 
organization is impaired; 

(Internal Audit is a valuable and essential 
function in ministries of any size, but is 
particularly useful in complex, decentralized 
ministries where a large degree of authority 
is necessarily delegated. In these situations 
sound accountability and control systems 
are critical. Therefore, assurance from the 
auditors on the state of these systems is 
particularly essential.) 

(ii) assistance in the fullfillment of manage- 
ment policies by promoting an understand- 
ing of policies amongst auditees and in the 
improvement of policies by reporting on their 
effectiveness; 

(iii) Service in the audit field can be effective 
training for potential managers because of 
the wide exposure to the organization and 
the management process which it provides; 
(iv) finally, by providing assurance on 
ministry control, Internal Audit indirectly 
benefits central agencies. Management 
Board Secretariat and the Ministry of Treas- 
ury and Economics have chosen to rely upon 
the internal audit functions of ministries to 
carry out the auditing requirements associ- 
ated with their corporate policies. Thus, 
while the ministry internal audit function is 
under exclusive direction of ministry man- 
agement, it provides the information 
required for the effective operation of their 
corporate policies. 


Audit Organizations in the 
Government of Ontario 


Ministry Internal Audit Branch 


The internal audit function in any given 
ministry will be organized to best meet the 
needs of that ministry. Since the needs may 
vary from ministry to ministry, the organiza- 
tion for Internal Audit may vary as well. 


However, one denominator, common to all 
ministries of sufficient size, is the Internal 
Audit Branch. Ministries of a lesser size are, 
as arule, served by Internal Audit Branches 
of other ministries. 


The Internal Audit Branch is characterized 
by the following features: 


(i) its only function is auditing and it is 
independent of the regular operations of 
management. Independence is necessary 
since the branch is concerned, amongst 
other things, with assessing controls 
designed to ensure propriety and probity in 
the care of government assets; 

(ii) notwithstanding (i), it exists to assist 
managers and especially the Deputy Minis- 
ter in discharging their duties; 

(iii) the Internal Audit Branch is expected to 
specialize in management and financial 
control systems. 


The staff of the Internal Audit Branch are the 
major continuing participants in the internal 
audit function in any ministry. The Cabinet 
and Management Board have agreed that, 
over time, ministries should, as a goal, work 
towards establishing a single, integrated, 
independent internal audit function. How- 
ever, at present, staff of other organizations 
may also participate in auditing, on either a 
full-time or part-time basis. 


Personnel Audit Branch 
Civil Service Commission 


This Branch has been established under the 
authority of The Public Service Act. It reports 
to the Chairman of the Civil Service Commis- 
sion. 


The Branch audits the application of corpo- 
rate personnel policies and procedures ona 
service-wide basis. Its purpose is to evaluate 
compliance with personnel policies, identify 
potential for improvement in the personnel 
systems examined, and recommend 
changes to ministries and the Commission. 
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Personnel audits carried out by ministries 
can complement audits by the Personnel 
Audit Branch. Indeed, ministry audits may 
supplement the efforts of the branch, where 
the reliability of ministry audits is established 
to the satisfaction of the Commission. 


Office of the Provincial Auditor 


The Provincial Auditor is an officer of the 
Legislative Assembly and makes his annual 
report, through the Speaker, to the Assem- 
bly. 


The Provincial Auditor is required by The 
Audit Act (1977) to examine and report on 
the accounts of receipts and disbursements 
of public money and on the financial 
statements of the Province as shown in the 
Public Accounts. The Auditor is also required 
either to audit the accounts and financial 
transactions of agencies of the Crown, or to 
direct the audits if they are carried out by 
another auditor. 


The mandate of the Provincial Auditor was 
expanded under the terms of The Audit Act 
(1977). This Act provides for the Auditor to 
report on cases where money is expended 
without due regard to economy and effi- 
ciency, or where procedures to measure and 
report on the effectiveness of programs were 
not established or were deemed unsatisfac- 
tory. 
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3. Principles and Standards 
Standards for Ministry Internal 


Audit Processes 


In Chapter 2, the context for internal audit 


and its objectives, role and potential benefits 


were discussed. 


Chapter 3 provides senior ministry manage- 


ment with the key principles and standards to 


use in the evaluation of an internal audit 
function. 


Principles refer to the necessary underlying 
environment and structure in which those 
responsible for the administration of an 
internal audit process operate. In this book- 
let, the principles for the process refer to 
those pre-conditions which must exist in 
order for internal audit to be effective. 
Standards are intended to govern the 
repetitive process of planning, day-to-day 
management and reporting in the internal 
audit function. The principles and standards 
are a Set of criteria against which the quality 
of the internal audit process can be meas- 
ured. 


The diagram across presents a summary of 
the principles and standards. The principles 
are shown in the outer ring providing the 
necessary framework for the standards in 
the inner ring. 


Figure 3 Principles and Standards 
for the Internal Audit Process 


It is essential to establish the relationship 
between the principles and standards cov- 
ered in this part and “Standards for the 
Professional Practice of Internal Auditing in 
the Government of Ontario”. The latter have 
been accepted by the internal audit commu- 
nity as their professional code. As part of the 
standards concerning the day-to-day man- 
agement of the Internal Audit Branch, the 
Internal Audit Director is charged with 
responsibility for ensuring that audit work 
conforms to the standards for the Profes- 
sional Practice of Internal Auditing. 
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Principles 

The key principles for an effective and 
successful internal audit process are 
organized under five headings: Senior Man- 
agement Support for Internal Audit, Man- 
agement Confidence in Internal Audit Staff, 
Systems-Orientation, Independence, and 
Mandate. 


Senior Management Support For internal 
Audit 


The involvement and support of the Deputy 
Minister and senior management is essen- 
tial to the effective working of the Internal 
Audit function. 


Some of the specific ways in which senior 
management may assist the internal Audit 
function are: 


e Promulgation by the Deputy Minister of a 
clear statement of the authority, purpose 
and duties of the internal audit function, 
including a clear expression of support; 


e Providing an effective mechanism for 
following up and resolving audit recom- 
mendations; 

@ Participating in the audit planning process 
within an appropriate forum, such as an 
audit committee. A typical ministry audit 
committee is described in Appendix B. 


Process Principle: 


(1) Internal audit has the visible full 
support of senior management. 


Management Confidence in Internal 
Audit Staff 

In order to obtain the full support of senior 
management, internal auditors must gain 
their confidence. To do this, internal auditors 
must ensure that their work is credible, 
relevant to the specific needs of manage- 
ment, understood, and presented in a way 
which will maximize its usefulness to the 
various levels of management. 


As well, auditors must establish a positive 
rapport with management. Hence, auditors 
should strive to understand management 
and its problems and challenges and to 
communicate effectively to management an 
understanding of the supportive role of 
internal audit. 


Process Principle: 


(2) Internal auditors have the confidence 
of ministry managers. 


Systems-Oriented Approach 

Managers are more and more asking internal 
auditors to help them improve their control 
systems. When errors or problems are 
identified, the auditor has a responsibility to 
report not only what happened, but also why 
it happened and what can be done to prevent 
a recurrence. 


There is an increasing demand for auditors 
who can help management put their findings 
into an overall perspective, that is, “put the 
pieces back together again”. Instead of just 
trying to understand systems by taking them 
apart, they look at them as part of larger 
systems. Auditors are, in fact, required to 
develop a systems-oriented approach. 


Process Principle: 


(3) Internal auditors look at total control 
systems as well as specific components. 


independence 


To ensure the necessary independence and 
support for the Internal Audit function, the 
director of the Internal Audit function should 
report to the Deputy Minister or to another 
senior executive who reports directly to the 
Deputy Minister. If the reporting relationship 
is the latter, the director of the internal audit 
function should have ready access to the 
Deputy Minister. 
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Process Principle: 


(4) The Director of internal Audit has 
access to the Deputy Minister. 


Mandate 


Each Internal Audit Branch must have Terms 
of Reference approved by the Deputy 
Minister and published for the information of 
all those affected by its activities. 


The Terms of Reference should contain, at 
least, the following headings: 


e Objectives 

Reflecting the three headings of assurance, 
timely reporting, and change (reference, 
page 8). 


e Scope of Work 

Describing the area of responsibility 
assigned to the internal audit function 
including the responsibility for evaluating 
and reporting on the ministry’s control 
function, as described on pages 9 to 10. It 
should include requirements for periodic 
status reports designed to meet the needs of 
senior management (reference, page 17, 
audit reporting). 


It is advisable to indicate clearly the distinc- 
tion between the responsibilities of internal 
audit, on the one hand, and of program 
management and program evaluation on the 
other. The role of internal audit regarding the 
development of new policies, systems and 
procedures should be clarified. 


® Scope of Coverage (The “Audit 
Universe”) 

Defining the organization’s programs, 
activities and functions which are subject to 
audit. 


Where agencies, boards and commissions 
are involved, reporting relationships should 
be clearly set out. 


® Access to Information 

Establishing the auditor’s authority to obtain 
access to the material and persons required 
to carry out audits. 


e Reporting Relationship 
The reporting relationship of the director of 
the internal audit function should be set out. 


Since the Terms of Reference of an Internal 
Audit Branch govern, essentially, its respon- 
sibilities and relationships with Senior Man- 
agement and the organizational units of the 
Ministry, it is important that they are devel- 
oped with the assistance of input from these 
interested parties. 


Process Principle: 
(5) The mandate of the Internal Audit 


Branch is clearly and comprehensively 
expressed in terms of reference. 
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Standards 
These standards are designed for the typical 
Internal Audit Branch. 


They are organized under three headings: 
Audit Program Planning, Day-to-Day Man- 
agement of the Internal Audit Branch, and 
Audit Reporting. 


Audit Program Planning 


Regardless of whether internal audit is 
organizationally integrated, there is a 
requirement for an integrated internal audit 
plan. This plan should encompass all inter- 
nal audits carried out within the ministry 
regardless of which organizational unit does 
them. The plan should ensure that overlaps 
and gaps in coverage are minimized and that 
an effective mechanism for coordinating the 
execution of audit activities exists. 


An analysis of the ministry should be done, 
identifying as potential audit areas all 
organizational components, programs and 
activities, and revenue from outside sources 
when applicable. A tentative schedule 
should be prepared ordinarily extending over 
several years and updated annually. 


The detailed audit program should be 
developed through a rigorous planning pro- 
cess. 


This task should include consideration of: 


e The frequency with which the various 
elements of the control process and the 
various organizational units, programs, 
activities and functions are to be auditied; 


e The scope and objectives for each audit. 
(With respect to the two points above, all 


potential audits should be assessed and 
priorized according to defined criteria.) 


e The needs, priorities and information 
requirements of Central Agencies (i.e. 
Management Board Secretariat and the 
Ministry of Treasury and Economics) with 
respect to compliance with their policies, 
procedures and directives. 


Senior management should be involved in 
the planning process so that their concerns 
are fully considered. 


Process Standard: 


(1) There is a formal audit program plan, 
developed through a rigorous planning 
process. 


Day-to-Day Management Of The 
Internal Audit Branch 


The Director of Internal Auditing is responsi- 
ble for properly managing the internal 
auditing branch so that: 


e Audit work fulfills the general purposes 
and responsibilities aoproved by manage- 
ment; 

e Resources of the branch are efficiently 
and effectively employed; 

e@ Audit work conforms to the Standards for 
the Professional Practice of Internal Audit- 
ing. (See Appendix C) 


Process Standard: 


(2) The Director of Internal Audit is ina 
position to provide assurance that that 
branch is properly managed and follows 
the standards for professional practice 
set out in Appendix C. 
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Audit Reporting 


The essence of effective reporting is that it 
should provide those who need to know with 
the information they actually require at the 
appropriate time for them to take action. It 
follows that there will be several types and 
levels of Internal Audit reports, each having 
its own specific purpose. 


e Audit Program Progress Reports 

If the audit program is to achieve its 
objectives, it must be kept on schedule. A 
regular series of scheduled interim and 
annual reports must be provided showing 
the degree of conformity to the internal audit 
program plan, noting variances and propos- 
ing ways of resolving them. 


e Audit Findings Reports 

Findings should be presented in a way that 
will maximize their usefulness to the various 
levels of management. For example, Deputy 
Ministers may want a summarized account 
of problems and action needed or taken 
while directors or Supervisors may want a 
more detailed description of the specific 
audit findings to enable them to develop 
solutions to problems. 


The scope and objectives of each audit 
should be carefully explained in the report to 
the findings so that the extent and nature of 
the work carried out can be readily under- 
stood and assessed. 


Reports sent to the Deputy Minister should 
make it clear whether: 


a) Hecan place overall reliance on the 
systems examined; 


b) There are problems but these have been 
brought to the attention of management and 
steps are being taken to remedy them; 


c) There are some relatively serious prob- 
lems which require action on his part. 


Efforts should be made to ensure that 
reports are timely. Where an assignment 
extends over several months, consideration 
should be given to the need for interim 
reports. Any urgent problems uncovered 
during the course of an audit should be 
reported immediately. 


Process Standard: 


3. (i) The status of the audit program is 
regularly reported on; 


(ii) Reports on audit findings are 
structured to meet management 
needs. 


18 


Appendix “A” 


Requirements for EDP 
Auditing 


Due to the range and sensitivity of data 
processed by computer, electronic data 
processing systems warrant particular atten- 
tion. Moreover, because of the complex 
nature of acomputer systems development 
process, this process itself merits particular 
attention. Ministries shall develop and main- 
tain appropriate audit capacity to assure 
compliance with the full intent of existing 
government policies in respect to EDP. 
Accordingly, they should, at a minimum, 
ensure that the internal audit function: 


a) Complies fully with the intent of EDP 
Financial Systems Accounting Policies. 
(Reference: Treasury Manual, Statement 
102); 


b) Participates meaningfully in the design, 
development and implementation of new 
systems and the significant modification of 
existing systems in order to provide assur- 
ance that these systems incorporate appro- 
priate controls for the desired level of 
auditability and data integrity; 


c) Provides audit assurance that ministry 
systems are being developed in accordance 
with the Government's approved methodol- 


ogy, 


d) Conducts post-implementation audits of 
all (significant) newly installed or modified 
systems in order to ensure that such systems 
meet their design objectives and incorporate 
appropriate controls for data integrity, secur- 
ity and auditability. 


we 
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Appendix “B” 


Description of a Typical 
Ministry Audit Committee 


It is up to each ministry to decide whether an 
Audit Committee would be useful. It may be 
a distinct committee or simply a senior 
ministry management committee sitting as 
an audit committee. Whatever its form, it 
should be comprised of senior officials with 
the rank and authority to ensure adequate 
consideration of the matters coming before 
it. 


Composition: 


Deputy Minister, senior level officials (e.g. 
Assistant Deputy Ministers/Executive Direc- 
tors) 


Note: The Director of Internal Audit should 
not be amember of the Audit Committee. He 
or she should, however, attend meetings ina 
Staff capacity when requested to do so by 
the Committee. 


Terms of Reference: 


(a) review and approval of the ministry's 
audit policies, objectives, priorities, scope 
and coverage; 


(b) review and approval of the internal audit 
plan; 


(c) review of internal audit recommenda- 
tions as well as the responses of program 
managers to them; 


(d) review of recommendations made by the 
Provincial Auditor, the Standing Committee 
on Public Accounts, the Personnel Audit 
Branch of the Civil Service Commission and, 
in addition, the review of the ministry's 
response to them to ensure that it represents 
a balanced view of the ministry's position; 


(e) resolution of issues or problems arising 
between program managers and auditors as 
a result of the audits and the subsequent 
follow-up on the implementation of audit 
recommendations which cannot be ade- 
quately addressed at the operating level; 


(f) evaluation of the adequacy and reliability 
of the ministry’s control process; and 


(g) assessment of the effectiveness of the 
internal audit function. 


Chairman: 


Meetings would be chaired by the Deputy 
Minister. 


Meetings: 

The Audit Committee would probably meet 
from two to six times per year as circumstan- 
ces require. 


Minutes: 


Formal minutes should be kept to record and 
convey Committee activities and decisions. 
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Appendix “C” 


Professional Practice 
Standards 


The following has been extracted from 
“Standards for the Professional Practice of 
Internal Auditing in the Government of 
Ontario”, developed and issued by the 
Ontario Public Service Internal Auditors’ 
Council. For complete information on the 
subject, please refer to this publication. 


200 Professional Proficiency — 
Internal Audits should be 
performed with 
proficiency and due 
professional care. 


The Internal Auditing Branch 
210 Staffing 


The internal auditing branch should 
provide assurance that the technical 
proficiency and educational back- 
ground of internal auditors are appro- 
priate for the audits to be performed. 


220 Knowledge, Skills, and Disciplines 


The internal auditing branch should 
possess or should obtain the know- 
ledge, skills, and disciplines needed to 
carry out its audit responsibilities. 


230 Supervision 
The internal auditing branch should 


provide assurance that internal audits 
are properly supervised. 


The Internal Auditor 


240 Compliance with Standards of 
Conduct-— Internal auditors should 
comply with professional standards of 
conduct. 


250 Knowledge, Skills and Disciplines — 
Internal auditors should possess the 
knowledge, skills, and disciplines 
essential to the performance of inter- 
nal audits. 


260 Human Relations and Communica- 
tions— Internal auditors should be 
skilled in dealing with people and in 
communicating effectively. 


270 Continuing Education —Internal audi- 
tors should maintain their technical 
competence through continuing 
education. 


280 Due Professional Care-—Internal 
auditors should exercise due profes- 
sional care in performing internal 
audits. 


440 Performance of Audit 
Work-— Audit Work should 
include planning the audit, 
examining and evaluating 
information, communicat- 
ing results, and follow up. 


410 Planning the Audit 


Internal auditors should plan each 
audit. 


420 


430 


440 


Examining and Evaluating Informa- 
tion 


Internal auditors should collect, 
analyze, interpret, and document 
information to support audit results. 
Communicating Results 


Internal auditors should report the 
results of their audit work. 


Following Up 
Internal auditors should follow up to 


ascertain that appropriate action is 
taken on reported audit findings. 


900 Management of the 


510 


Internal Auditing Branch— 
The Director of Internal 
Auditing should properly 
manage the Internal 
Auditing Branch. 


Purpose, Authority, and 
Responsibility 


The director of internal auditing should 
have a statement of purpose, author- 
ity, and responsibility for the internal 
auditing branch. 


520 


530 


540 


950 


560 
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Planning 


The director of internal auditing should 
establish plans to carry out the 
responsibilities of the internal auditing 
branch. 


Policies and Procedures 


The director of internal auditing should 
provide written policies and proce- 
dures to guide the audit staff. 


Personnel Management and 
Development 


The director of internal auditing should 
establish a program for selecting and 
developing the human resources of 
the Internal Auditing Branch. 


External Auditors 


While most ministries do not employ 
External Auditors it is common prac- 
tice in some Agencies, Boards and 
Commissions. The director of internal 
auditing should coordinate internal 
and external audit efforts. 


Quality Assurance 


The director of internal auditing should 
establish and maintain a quality assur- 
ance program to evaluate the opera- 
tions of the Internal Auditing Branch. 
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Appendix “D” 


Summary of the Principles and 
Standards for Ministry Internal 
Audit Processes 


The internal audit process is satisfactory 
when: 


Principles 


1 


. Internal audit has the visible full support of 
senior management. 


2. Internal auditors have the confidence of 


ministry managers. 


3. Internal auditors look at total control 


systems as well as specific components. 


4. The Director of Internal Audit has access 


to the Deputy Minister. 


5. The mandate of the Internal Audit Branch 


is clearly and comprehensively expressed 
in terms of reference. 


Standards 


1 


There is a formal audit program developed 
through a rigorous planning process. 


; The director of internal audit is ina 


position to provide assurance that the 
branch is properly managed and follows 
the standards for professional practice set 
out in Appendix C. 


. (i) The status of the audit program is 


regularly reported on; and 


(ii) Reports on audit findings are struc- 
tured to meet management needs. 
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